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Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1 )S Responsive to communication(s) filed on 20 February 2007 . 
2a)D This action is FINAL, 2b)(EI This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) (KI Claim(s) 1,4,8-16 and 20 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) £3 Claim(s) 1,4,8-16 and 20 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10) Q The drawing(s) filed on is/are: a)Q accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

1 1) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)D All b)D Some * c)D None of: 

1. n Certified copies of the priority documents have been received. 

2. D Certified copies of the priority documents have been received in Application No. . . 

3. D Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 

1. Claims 1, 4, 8-16, and 20 are pending. 

2. > A request for continued examination under 37 CFR 1.114, 
including the fee set forth in 37 CFR 1.17(e), was filed in this 
application after final rejection. Since this application is 
eligible for continued examination under 37 CFR 1.114, and the 
fee set forth in 37 CFR 1.17(e) has been timely paid, the 
finality of the previous Office action has been withdrawn 
pursuant to 37 CFR 1.114. Applicant's submission filed on 
02/20/2007 has been entered. 

Claim Rejections - 35 USC §101 

3. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, 
manufacture, or composition of matter, or any new and useful improvement 
thereof, may obtain a patent therefor, subject to the conditions and 
requirements of this title. 

Claims 12-16 and 20 are rejected under 35 U.S.C. 101 because the 

claimed invention is directed to non-statutory subject matter. 

Claims 12' and 13 relate to a computer data signal, which fails 

to fall within one of the categories of patentable subject 

matter. Similarly, claims 14-16 and 20 relate to an apparatus 

with components, in these claims there is not explicit hardware 

and these components may merely be software (see paragraph 30 of 

the specification. Therefore, these claims lack the necessary 
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physical articles or objects to constitute a machine or a 
manufacture within the mean of 35 USC 101. They are clearly not 
a series of steps or acts to be a process not are they a 
combination of chemical compounds to be a composition of matter. 
As such, they fail to fall within a statutory category. They 
are, at best, functional descriptive material per se. 

Claim Rejections - 35 USC §102 

The following is a quotation of the appropriate paragraphs 
of 35 U.S.C. 102 that form the basis for the rejections under 
this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published 
under section 122(b), by another filed in the United States before the 
invention by the applicant for patent or (2) a patent granted on an 
application for patent by another filed in the United States before the 
invention by the applicant for patent, except that an international 
application filed under the treaty defined in section 351(a) shall have the 
effects for purposes of this subsection of an application filed in the 
United States only if the international application designated the United 
States and was published under Article 21(2) of such treaty in the English 
language. 

4. Claims 1, 4 and 10-16 are rejected under 35 U.S.C. 102(e) 
as being anticipated by Chess (US 6192512) . 

As per claims 1, 10, 11, 12, and 14, Chess discloses a 
method of detecting viral code in subject files, comprising: 
creating an artificial memory region spanning one or more 
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components of the operating system (see Fig. 2 column 4 lines 
49-51); emulating execution of at least a portion of computer 
executable code in a subject file (see column 4 lines 33-49); 
detecting an attempt by the emulated computer executable code to 
access the artificial memory region; and determining based on 
the attempt to access the artificial memory region that the 
emulated computer executable code is viral .(see column 4 lines 
49-54). 

As per claims 4 and 16, Chess discloses emulating 
functionality of the identified operating system call while 
monitoring the operating system call to determine whether the 
computer executable code is viral (see column 4 lines 33-54). 

As per claims 13 and 15, Chess discloses a fourth segment 
comprising auxiliary code, wherein the auxiliary code determines 
an operating system call that the emulated computer executable 
code attempted to access; a fifth segment comprising analyzer 
code, wherein the analyzer code monitors the operating system 
call to determine whether the computer executable code is viral, 
while emulation continues (see column 4 lines 33-54). 



Claim Rejections - 35 USC §103 
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5. The following is a quotation of 35 U.S.C. 103(a) which 
forms the basis for all obviousness rejections set forth in this 
Office action: 

(a) A patent may not be obtained though the invention is not 
identically disclosed or described as set forth in section 102 of this 
title, if the differences between the subject matter sought to be 
patented and the prior art are such that the subject matter as a whole 
would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the 
invention was made. 

6. Claims 8, 9, and 20 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over Chess as applied to claims 1 and 14 
above, in view of Golan (US 5974549) . 

As per claim 8, Chess fails to disclose monitoring access 
by the emulated computer executable code to dynamically linked 
functions. 

However, Golan teaches monitoring access by the emulated 
computer executable code to dynamically linked functions (Col 6, 
lines 6-12; Col 5, lines 60-63) ; and Golan describes a security 
monitor method whereby access to dynamically linked functions is 
regulated because, as Golan discloses, u in an operating system 
that supports virtual memory and hardware abstraction, a 
software component can only breach security by calling a system 
call ,/ (Col 5, lines 38-41) . 

It would have been obvious to one of ordinary skill in that 
art at the time the invention was filed to have combined the 



Application/Control Number: 09/905,532 . Page 6 

Art Unit: 2137 

teachings of Chess with those of Golan and monitor access to 
dynamically linked functions because requesting access to 
dynamically linked functions could be an attempt to breach 
security . 

As per claim 9, the applicant discloses the method of claim 
8, which is met by Chess in view of Golan (see above) , with the 
following limitation which is met by Golan: 

Wherein the artificial memory region spans a jump table 
containing pointers to the dynamically linked functions (Col 7, 
lines 31-35) . 

Chess in view of Golan describes all the limitations of 
claim 8. Golan describes the additional limitation of a jump 
table containing pointers to the dynamically linked functions. 
The jump table is often incorporated with dynamically linked 
functions to store the actual addresses of the dynamically 
linked functions. It would have been obvious to one of ordinary 
skill in the art at the time in the invention was filed to have 
included a jump table with the method so that there could be a 
way of storing the actual addresses of the dynamically linked 
functions . 

As per claim 20, the applicant discloses the method of 
claim 14, which is met by Chess (see above), with the following 
limitation which is met by Golan: 
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Wherein the artificial memory region created by the memory 
manager component spans a jump table containing pointers to 
dynamically linked functions, and the monitor component monitors 
access by the emulated computer executable code to the 
dynamically linked functions. 

The claim is met by the combination of claims 8 and 9. 
Explanations for claim 8 and 9 rejections are listed above. 

Response to Arguments 

7. Applicant's arguments with respect to claims 1, 4, 8-16, 
and 20 have been considered but are moot in view of the new 
ground(s) of rejection. 

Conclusion 

8. The prior art made of record and not relied upon is 
considered pertinent to applicant's disclosure. Nachenberg, 
Kouznetsov, and Schnurer teach methods of detecting viruses 
using artificial memory. 

Any inquiry concerning this communication or earlier 
communications from the examiner should be directed to Michael 
Pyzocha whose telephone number is (571) 272-3875. The examiner 
can normally be reached on 7:00am - 4:30pm first Fridays of the 
bi-week off. 
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If attempts to reach the examiner by telephone are 
unsuccessful, the examiner's supervisor, Emmanuel Moise can be 
reached on (571) 272-3865. The fax phone number for the 
organization where this application or proceeding is assigned is 
571-273-8300. 

Information regarding the status of an application may be 
obtained from the Patent Application Information Retrieval 
(PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status 
information for unpublished applications is available through 
Private PAIR only. For more information about the PAIR system, 
see http://pair-direct.uspto.gov. Should you have questions on 
access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free) . If you would 
like assistance from a USPTO Customer Service Representative or 
access to the automated information system, call 800-786-9199 
(IN USA OR CANADA) or 571-272-1000.' 



MJP 



EMMANUEL L MOISE 
SUPERVISORY PATENT EXAMINER* 




